Wireshark-bugs: [Wireshark-bugs] [Bug 8229] Need a way to treat alleged Ethernet frames as raw I
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 28 Jan 2013 20:54:33 +0000

Comment # 4 on bug 8229 from 
(In reply to comment #0)
> I classified this as bug, not as feature request, because currently decoding
> of packets fails without any workaround available.

(In reply to comment #2)
> Wireshark can only provide a workaround.  

A possible, although admittedly not ideal, workaround would be to use something
as follows: File -> Export Packet Dissections -> as "Plain Text" file... , then
deselect both "Packet summary line" and "Packet details" but select "Packet
Bytes".  After this, use text2pcap to convert this text file back to a pcap
file, utilizing the -e <l3pid> option to prepend a dummy Ethernet header to
each packet.

Note that this will only work if all packets actually have the same L3PID
(i.e., if all packets are IPv4 packets and you use -e 0800), and of course if
you don't really care about the Ethernet header details.

One other caveat is that when you export the packets to a text file, you may
get some duplicated output - a block of frame data, and a second block, which
will be a subset of the first block, which is "Not dissected data bytes".  You
will need to delete the "Not dissected data bytes".  It would be nice if the
"Not dissected data bytes" could be turned off somehow.

You are receiving this mail because:
  • You are watching all bug changes.